EU-Hosted Web Analytics in 2026: Who Owns Them, Where the Data Lives
Most "EU analytics" lists confuse EU hosting with EU ownership. Here is the list that separates them: who owns each tool, where the data lives, and what that means under GDPR.
Last checked: October 27, 2026. Each row links to the vendor's own page we read that day; ownership and hosting can change without notice. Spotted something out of date, or something wrong about your tool? Write to hello@datalenk.com and we will correct it.
With the EU-US Data Privacy Framework under appeal at the CJEU ↗, "EU-hosted analytics" is back on many shortlists. But lists answering this search often mix up three different things, and the difference is exactly what matters legally.
The three questions that actually matter
1. Where does the data live? EU data centers mean EU jurisdiction over the stored data. This is what "EU-hosted" should mean, and it is the easy part.
2. Who owns the company? This is the part lists often skip. A US-owned company storing your data in Frankfurt is still subject to US law: the CLOUD Act lets US authorities require US providers to produce data in their control wherever it is stored. If your threat model is "US authorities' reach", ownership matters as much as server location. The Schrems litigation is entirely about this gap.
3. How much personal data does the tool actually collect? A tool that writes nothing to the device and never stores IP addresses has a much smaller GDPR surface regardless of geography. Almost no analytics tool collects zero personal data (an IP arrives with every request, and a pseudonymous session ID is still personal data), so the useful question is not "does it collect any" but "what exactly does it keep, and for how long". Architecture beats geography ↗.
The table below answers all three, because a list that only answers the first one is marketing.
The list
| Tool | Company | Where the data is stored | Source |
|---|---|---|---|
| Plausible | Incorporated in Estonia | EU; Plausible states visitor data does not leave the EU | Data policy |
| Pirsch | Emvi Software GmbH, Germany | Germany, at Hetzner | Privacy policy |
| Simple Analytics | Netherlands (Bussum) | Servers in the Netherlands | Privacy policy |
| Datalenk | GO TO AGENCY, France | Servers and databases in the European Union (Hetzner); Cloudflare, a US company, as CDN in front | Sub-processors |
| Sealmetrics | Not stated on its homepage | Dublin, Ireland | Homepage |
| Matomo Cloud | InnoCraft Limited, New Zealand (EU adequacy decision) | Frankfurt on Amazon Web Services, backups in Dublin | Privacy policy, sub-processors |
| Fathom | Conva Ventures Inc., Canada (EU adequacy decision) | Fathom states it processes EU visitor data through EU infrastructure | Privacy policy |
| PostHog EU Cloud | PostHog Inc., United States | Frankfurt region | Data storage |
| Umami Cloud | Umami Software, Inc. | Not stated in its privacy policy; self-hosted Umami runs wherever you put it | Privacy policy |
A US-owned company with EU servers (PostHog EU Cloud here) remains subject to US legal process, including the CLOUD Act. That is fine for many threat models and not for strict EU-sovereignty requirements. The same reasoning applies one level down: Matomo Cloud is run by a New Zealand company on Amazon's infrastructure in Frankfurt.
Self-hosted open source (Umami, Matomo, Plausible CE, Rybbit and others) deserves its own mention: hosting it yourself on an EU server (Hetzner, OVH, Scaleway...) gives you full EU residency by construction, in exchange for operating it. For teams with ops capacity, it is the strongest sovereignty position available.
How to choose, by requirement
- "I want no US parent company." EU-owned + EU-hosted, from the table: Plausible, Pirsch, Simple Analytics, Datalenk, or self-hosted open source on EU infrastructure. One caveat worth stating plainly, because many lists (including earlier versions of this one) blur it: "no US parent" is not the same as "no US sub-processor". Almost every SaaS, ours included, uses at least one US vendor somewhere in its own operations, typically for billing or transactional email. That vendor never touches your visitors' analytics data, but it exists. Ask each tool on this list for its sub-processor list, including ours, and read it before you write "zero US exposure" in a compliance document.
- "I want EU residency but ownership matters less." Add Matomo Cloud, Fathom with EU Isolation, PostHog EU Cloud.
- "I want to shrink the question as far as it goes." On top of EU hosting, prefer tools that are cookieless by default and store no raw IPs: the analytics part of your GDPR exposure then comes down to a paragraph in your privacy policy rather than a transfer-risk assessment, whatever happens in Luxembourg ↗.
- "I also need revenue attribution / campaign tracking." Several EU tools record revenue: Plausible has revenue goals fed by your own events, Matomo ships an e-commerce module. What Datalenk adds is reading the payments from the provider itself (Stripe and others) and keeping the first channel attached to the customer through renewals, plus revenue per search query.
Apply the two questions to us too. What Datalenk writes to the device by default (nothing), what waits for the visitor's consent, what it keeps, and what changes if you turn on the optional persistent layer: ↗. Our providers, US ones included: sub-processors.
What about Google Analytics with EU settings?
A frequent question. GA4 offers regional controls and IP handling settings, but the data is processed by a US company under US jurisdiction, which is the exact configuration the 2022 DPA rulings (Austria, France, Italy) found unlawful when transfer frameworks lapse ↗. Today it is lawful under the DPF; the point of this list is to know your options if a court ruling changes that.
FAQ
What is the difference between EU-hosted and EU-owned analytics? EU-hosted means the servers are in the EU. EU-owned means the company itself is under EU jurisdiction. A US-owned company with EU servers remains subject to US legal process (CLOUD Act), which is why strict sovereignty requirements need both.
Which web analytics tools are EU-owned and EU-hosted? As of October 2026, on the vendors' own public pages: Plausible (Estonia), Pirsch (Germany), Simple Analytics (Netherlands) and Datalenk (France), plus any open-source tool you self-host on EU infrastructure. Ownership and hosting are not the same as the vendor's own sub-processor chain, so ask each one for its sub-processor list if your requirement is strict.
Is Matomo European? Matomo's maker InnoCraft is a New Zealand company (New Zealand holds an EU adequacy decision). Matomo Cloud stores data in Frankfurt on Amazon Web Services, and self-hosted Matomo lives wherever you deploy it.
Do I still need this if the Data Privacy Framework survives its appeal? The list is useful either way: EU-hosted tools keep your measurement layer independent of how the litigation ends.